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ANNEX 


Proposal for a 
REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL 


laying down rules to prevent and combat child sexual abuse 


(Text with EEA relevance) 
CHAPTERI 
GENERAL PROVISIONS 
Article 1 
Subject matter and scope 


Subject matter and scope 


1. This Regulation lays down uniform rules to prevent and address the misuse of relevant 
information society services for online child sexual abuse in the internal market. 


It establishes, in particular: 


(a) obligations on providers of relevant information society services to minimise the risk 
that their services are misused for online child sexual abuse; 


(b) obligations on providers of hosting services and providers of interpersonal 
communication services to detect and report online child sexual abuse; 


(c) obligations on providers of hosting services to remove or disable access to child 
sexual abuse material on their services; 


(d) obligations on providers of internet access services to prevent users from accessing 
disable access te-child sexual abuse material; 


(da) obligations on providers of online search engines to delist websites indicating 
specific items of child sexual abuse; 


(e) rules on the implementation and enforcement of this Regulation, including as regards 
the designation and functioning of the competent authorities of the Member States, 
the EU Centre on Child Sexual Abuse established in Article 40 (“EU Centre’) and 
cooperation and transparency. 
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3. 


This Regulation shall apply to providers of relevant information society services offering 
such services in the Union, irrespective of their place of main establishment. 


This Regulation shall not affect the rules laid down by the following legal acts: 


(a) 


(b) 


(ba) 


(c) 


(d) 


(e) 


Directive 2011/93/EU on combating the sexual abuse and sexual exploitation of 
children and child pornography, and replacing Council Framework Decision 
2004/68/JHA; 


Directive 2000/31/EC and Regulation (EU) .../... [on a Single Market For Digital 
Services (Digital Services Act) and amending Directive 2000/3 1/EC]; 


Regulation (EU) 2022/... of ... on contestable and fair markets in the digital 
sector and amending Directives (EU) 2019/1937 and (EU) 2020/1828 (Digital 
Markets Act); 

Directive 2010/13/EU; 


Regulation (EU) 2016/679, Directive 2016/680, Regulation (EU) 2018/1725, and, 
subject to paragraph 4 of this Article, Directive 2002/58/EC; 


Regulation (EU) 2021/784 of the European Parliament and of the Council of 29 
April 2021 on addressing the dissemination of terrorist content online. 


3a. This Regulation shall not have the effect of modifying the obligation to respect the 
rights, freedoms and principles referred to in Article 6 TEU and shall apply without 
prejudice to fundamental principles relating to the right for respect to private life and 
family life and to freedom of expression and information. ! 


4. 


This Regulation limits the exercise of the rights and obligations provided for in 5(1) and 
(3) and Article 6(1) of Directive 2002/58/EC insofar as necessary for the execution of the 
detection orders issued in accordance with Section 2 of Chapter + II of this Regulation. 


Wording copied from Art. 1(4) of TCO Regulation. 
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Article 2 


Definitions 


For the purpose of this Regulation, the following definitions apply: 


(a) 


(b) 


(c) 


(d) 


(c) 


(f) 


‘hosting service’ means an information society service as defined in Article 2, point (f), 
third indent, of Regulation (EU) .../... fon a Single Market For Digital Services (Digital 
Services Act) and amending Directive 2000/3 1/EC]; 


‘number-independent interpersonal communications service’ means a publicly available 
service as defined in Article 2, point 7 5, of Directive (EU) 2018/1972, including services 
which enable direct interpersonal and interactive exchange of information merely as a 
minor ancillary feature that is intrinsically linked to another service; ? 

‘software application’ means a digital product or service as defined in Article 2, point 13, 
of Regulation (EU) .../... [on contestable and fair markets in the digital sector (Digital 
Markets Act)]; 


‘software application store’ means a service as defined in Article 2, point 12, of Regulation 
(EU) .../... [on contestable and fair markets in the digital sector (Digital Markets Act)] ; 


‘internet access service’ means a service as defined in Article 2(2), point 2, of Regulation 
(EU) 2015/2120 of the European Parliament and of the Council’; 


‘relevant information society services’ means all of the following services: 
(i) a hosting service; 
(11) an interpersonal communications service; 


(111) a software applications store; 


PCY comment: See Article 2(1) of the Temporary Regulation (EU) 2021/1232. Many 
opinions have been expressed that the scope should not include regular telecom providers 
but be limited to the number-independent service providers. The draft opinion of the IMCO 
Committee in the EP is also going in this direction and provides elaborate additions to recital 
5. 


Regulation (EU) 2015/2120 of the European Parliament and of the Council of 25 November 
2015 laying down measures concerning open internet access and amending Directive 
2002/22/EC on universal service and users’ rights relating to electronic communications 
networks and services and Regulation (EU) No 531/2012 on roaming on public mobile 
communications networks within the Union (OJ L 310, 26.11.2015, p. 1-18). 
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(g) 


(iv) an internet access service; 

(v) online search engines. 

‘to offer services in the Union’ means to offer services in the Union as defined in Article 2, 
point (d), of Regulation (EU) .../... [on a Single Market For Digital Services (Digital 
Services Act) and amending Directive 2000/3 1/EC]; 


‘user’ means any natural or legal person who uses a relevant information society service; 


‘child’ means any natural person below the age of 18 years;4 


> 


(k) 


(1) 


(m) 


(n) 


who-is-a natural person below-the age-of 17 years:> 


“micro, small or medium-sized enterprise’ means an enterprise as defined in Commission 
Recommendation 2003/361 concerning the definition of micro, small and medium-sized 
enterprises®; 


‘child sexual abuse material’ means: material constituting child pornography or 
pornographic performance as defined in Article 2, points (c) and (e), respectively, of 
Directive 201 1/93/EU; 


‘known child sexual abuse material’ means potential child sexual abuse material detected 
using the indicators contained in the database of indicators referred to in Article 44(1), 
point (a); 


‘new child sexual abuse material’ means potential child sexual abuse material detected 
using the indicators contained in the database of indicators referred to in Article 44(1), 
point (b); 


PCY comment: The term child appears 511 times in the whole proposal including in the 
explanatory statements. The PCY is of the view that the term child can be used where it does 
not lead to problematic incompatibilities between the exercise of powers by Member States, 
for instance when it comes to the notice mechanism being developed under Article 12. 

PCY comment: It seems superfluous to define child user since child is already defined in 
point (1) (in document 14143/22 the age was set at 18). Furthermore, the term child user 
appears in Articles 3(2)(e)(i1) and (111), 4(3), 6(1)(b) and (c) and 7(7), i.e on six occasions. 
As those Articles and paragraphs are discussed, alternative wording should be developed. 
Commission Recommendation of 6 May 2003 concerning the definition of micro, small and 
medium-sized enterprises (OJ L 124, 20.5.2003, p. 36-41). 
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(0) 


(p) 


(q) 


(s) 


(t) 


(u) 


(v) 


(w) 


(x) 


‘solicitation of children’ means the solicitation of children for sexual purposes as referred 
to in Article 6 of Directive 2011/93/EU; 


‘online child sexual abuse’ means the online dissemination of child sexual abuse material 
and the solicitation of children; 


‘child sexual abuse offences’ means offences as defined in Articles 3 to 7 of Directive 
2011/93/EU; 


‘recommender system’ means the system as defined in Article 2, point (0), of Regulation 
(EU) .../... fon a Single Market For Digital Services (Digital Services Act) and amending 
Directive 2000/31/EC]; 


‘content data’ means data as defined in Article 2, point 10, of Regulation (EU) ... [on 
European Production and Preservation Orders for electronic evidence in criminal matters 
(.../... e-evidence Regulation) ]; 


‘content moderation’ means the activities as defined in Article 2, point (p), of Regulation 
(EU) .../... fon a Single Market For Digital Services (Digital Services Act) and amending 
Directive 2000/31/EC]; 


‘Coordinating Authority of establishment’ means the Coordinating Authority for child 
sexual abuse issues designated in accordance with Article 25 by the Member State where 
the provider of information society services has its main establishment or, where 
applicable, where its legal representative resides or is established; 


‘terms and conditions’ means terms and conditions as defined in Article 2, point (q), of 
Regulation (EU) .../... fon a Single Market For Digital Services (Digital Services Act) and 
amending Directive 2000/31/EC] ; 


“main establishment’ means the head office or registered office of the provider of relevant 
information society services within which the principal financial functions and operational 
control are exercised; 


‘online search engine’ means an intermediary service as defined in Article 3, point (j), 
of Regulation (EU) .../... [on a Single Market For Digital Services (Digital Services 
Act) and amending Directive 2000/31/EC]. 
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CHAPTERII 
OBLIGATIONS OF PROVIDERS OF RELEVANT INFORMATION SOCIETY SERVICES 
TO PREVENT AND COMBAT ONLINE CHILD SEXUAL ABUSE 


Section 1 
Risk assessment and mitigation obligations 


Article 3 
Risk assessment 
Leaf 
[No new compromise texts in this Article] 
Article 4 


Risk mitigation 


Lend 
[No new compromise texts in this Article] 
Article 5 
Risk reporting 
[...] 
[No new compromise texts in this Article] 
Article 6 


Obligations for software application stores 


ea 


[No new compromise texts in this Article] 
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Section 2 
Detection obligations 


Article 7 
Issuance of detection orders 
[...] 
[No new compromise texts in this Article] 
Article § 
Additional rules regarding detection orders 
Fal 
[No new compromise texts in this Article] 
Article 9 
Redress, information, reporting and modification of detection orders 
Lasf 
[No new compromise texts in this Article] 
Article 10 
Technologies and safeguards 
ikea! 
[No new compromise texts in this Article] 
Article 11 
Guidelines regarding detection obligations 
fee] 


[No new compromise texts in this Article] 
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Section 3 
Reporting obligations 
Article 12 
Reporting obligations 


1. Where a provider of hosting services or a provider of interpersonal communications 
services becomes aware in any manner other than through a removal order issued in 
accordance with this Regulation of any information giving—rise—te—a—suspicion—of 
indicating that indicate potential online child sexual abuse on its services, it shall 
promptly submit a report thereon to the EU Centre in accordance with Article 13. It shall 
do so through the system established in accordance with Article 39(2). 


2: Where the provider submits a report pursuant to paragraph 1, it shall inform the user 
concerned, in accordance with the following sub-paragraphs providing information on 
the main content of ve pot onthe teh the ons has become- aware-of 


oh aemenm nants to - ae snd? on chi user’s Sonsibilities of rednese 
including on the right to submit complaints to the Coordinating Authority in accordance 
with Article 34. 


The provider shall inform the user concerned without undue delay, either after having 
received a communication from the EU Centre indicating that it considers the report to be 
manifestly unfounded as referred to in Article 48(2), or after the expiry of a time period of 
six three months from the date of the report without having received a communication 
from the EU Centre indicating that the information is not to be provided as referred to in 
Article 48(6), point (a), whichever occurs first. The time period of six months refered to 
in this subparagraph shall be extended by up to 6 months where so requested by the 
competent authority referred to in Article 48(6)-poimta. 


Where within the three-+menths- time period referred to in the second subparagraph the 
provider receives such a communication from the EU Centre indicating that the 
information is not to be provided, it shall inform the user concerned, without undue delay, 
after the expiry of the time period set out in that communication. 


3: The provider shall establish and operate an easy to access, accessible, effective, child- 
friendly age-appropriate and user-friendly mechanism that allows users to notify flag to 
the provider information that indicate potential online child sexual abuse on its—the 
service. Those mechanisms shall allow for the submission of notices by individuals or 


entities exclusively by electronic means and-witheut requiring that _thetserdeclare 
name or email address. 
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The mechanisms shall be such as to facilitate the submission of sufficiently precise 
and adequately substantiated notices. To that end, the providers shall take the 
necessary measures, with particular attention to the needs of the child, to enable and 
to facilitate the submission of notices, with a view to receiving: 


(a) a-sufficiently-substantiated-explanation_of the reasons why the user claims that 
the notice contains aHeges the information the notice question tebe online child 


sexual abuse;’ 


(b) a clear indication of the online location of the alleged online child sexual abuse 
at_information—_|,_such—as_the—exact_URL_—or—UREs,} and, where necessary, 
additional information specific to a service that enables ing the identification of 
its the-online location—ef_the-alleged_online-child-sexual_abuse-adapted_to_the 

if ; sa6, 


4. The Commission, in cooperation with Coordinating Authorities and the EU Centre 
and after having conducted a public consultation, shall issue guidelines on the 
application of paragraph 3, having due regard in particular to the child's age, 
maturity, views, needs and concerns. 


Article 13 
Specific requirements for reporting® 


1. Providers of hosting services and providers of interpersonal communications services shall 
submit the report referred to in Article 12 using the template set out in Annex III. The 
report shall include: 


(a) identification details of the provider and, where applicable, its legal representative; 
(b) the date, time stamp and electronic signature of the provider; 


(ba) manner in which the provider became aware of the potential child sexual abuse; 


u PCY comment: the PCY thinks it is difficult to find a reasonable balance between the need 
to be child-friendly and the need to ensure that the relevant information is obtained. The 
PCY wishes to hear the views of delegations on this issue. 

PCY comment: a recital could be included that would explain that since this CSA 
Regulation is /ex specialis to the DSA, reporting on CSA will only be carried out pursuant to 
this CSA Regulation and not pursuant to the DSA. That means that double reporting on 
CSA will be avoided. 
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(c) al-content data related to the reported potential online child sexual abuse; 
vee ne ae 

(d) al other available data related to the reported potential online child sexual abuse, 
including unique identifiers of the user and metadata related to media files and 
communications; 

(e) whether the potential online child sexual abuse concerns the dissemination of known 
or new child sexual abuse material or the solicitation of children; 

(f) information concerning the geographic location related to the potential online child 
sexual abuse, such as the Internet Protocol address of upload, with associated date 
and time stamp, and port number; 

(g) information concerning the identity of any user involved in the potential online child 
sexual abuse; 

(h) whether the provider has also reported, or will also report, the information that 
indicate potential online child sexual abuse to a public authority or other entity 
competent to receive such reports from ef a third country and if so, which authority 
or entity; 

(i) where the information that indicate potential online child sexual abuse concerns the 
dissemination of known or new child sexual abuse material, whether the provider has 
removed or disabled access to the material; 

(j) whether the provider considers that the report involves an imminent threat to 
the life or safety of a child or requires urgent action; ° 

(k) areference to this Regulation as the legal basis for reporting. 

2 The Commission shall be empowered to adopt delegated acts in accordance with Article 86 
in order to amend Annex III to improve the template where necessary in view of relevant 
technological developments or practical experiences gained. 

. In the template of Annex III, section 2, point 1, we could add the reason for the urgency. 
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Article 13a!" 


Emergency reporting 


i In the case of an imminent threat to the life or safety of a child, the providers of 
hosting services and providers of interpersonal communications services shall 
promptly and directly, in addition to paragraph 1(j) of Article 13, inform authorities 
competent to for the investigation and prosecution of criminal offences in the 
Member States concerned!!. Where the provider cannot identify with reasonable 
certainty the Member State concerned, it shall inform the law enforcement 
authorities of the Member State in which it is established or where its legal 
representative resides or is established and er inform Europol,-erbeth”. 


2. For the purpose of paragraph 1, the Member State concerned shall be the 
Member State in which the offence is suspected to have taken place, to be taking place 
or to be likely to take place, or the Member State where the suspected offender 


resides or is located, or the Member State where the victim of the suspected offence 
resides or is located. 


Section 4 
Removal obligations 


Article 14 
Removal orders 


a 


Coe ee ie ie ee 
spe ce piaketis aeeaNnen eee 


identified as Syste eeu serail abuse aural 


1. The competent authority shall have the power to issue a removal order, in accordance 
with relevant national requirements, requiring a provider of hosting services to 
remove or disable access in all Member States of one or more specific items of 
material that, after a diligent assessment, the Coordinating Authority erthe courts or 

referred +o Article 364) is identified as 


constituting child sexual abuse material. 


19 Text was included in Article 13(2) in doc. 7038/23. 
a Wording copied from Art. 14(5) of the TCO Regulation. 
a Wording copied from Art. 18(2) of the DSA. 


7595/23 FL/ml 12 
ANNEX JALI LIMITE EN 


2; The provider shall execute the removal order as soon as possible and in any event within 
24 Lhours of receipt thereof. The provider shall take the necessary measures to ensure 
that it is capable to reinstate the material or access thereto in accordance with Article 
15(1a). 

a FRecompetert ficdicitlaatherbh othe dideperdentadia taste tethers shal peste 
A removal order shall be issued using the template set out in Annex IV. Removal orders 
shall include: 

(a) identification details of the eempetent—udicial_or—independent—administrative 
authority issuing the removal order and authentication of the removal order by that 
authority; 

(b) the name of the provider and, where applicable, of its legal representative; 

(c) the specific service in respect of fer which the removal order is issued; 

(d) a sufficiently detailed statement of reasons explaining why the removal order is 
issued-and +n-particular-why the material constitutes child sexvalabuse materiak 

(da) where applicable, a statement of reasons explaining why the order is issued to a 
service provider that does not have its main establishment or legal 
representative in the Member State of the issuing authority according to the 
procedure provided for in Article 14a; 

(ec) atexactuntferm resource locatorand where necessary_additional-clear information 
fortheidentification_of enabling the provider to identify and locate the child 
sexual abuse material and -where necessary additional information: 

(f) where applicable, the information about non-disclosure during a specified time 
period, in accordance with Article 15(4), point (c); 

(fa) reporting requirements pursuant to point 7; 

(g) areference to this Regulation as the legal basis for the removal order; 

(h) the date, time stamp and electronic signature of the pidietal-or—imdependent 
administrathve-competent authority issuing the removal order; 

(i) easily understandable information about the redress available to the addressee of the 
removal order, including information about redress to a court and about the time 
periods applicable to such redress. 
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4. The judicial _authorityorthe independent administrative authority issuing the removal 
order shall address it to the main establishment of the provider or, where applicable, to its 
legal representative designated in accordance with Article 24. 


Ht-shall transm# The removal order shall be transmitted to the the provider’s point of 
contact referred to in Article 23(1) by electronic means capable of producing a written 
record under conditions that allow to establish the authentication of the sender, including 
the accuracy of the date and the time of sending and receipt of the order, to the 
Coordinating Authority of establishment and to the EU Centre, through the system 
established in accordance with Article 39(2). 


It shall draft transmit the removal order in any of the official languages declared by the 
provider pursuant to Article 23(3). 


The order may also be transmitted in any of the official languages of the Member 
State issuing the order, provided that it is accompanied by a translation of at least the 
most important elements necessary for the execution of the order into any of the 
official languages declared by the provider in accordance with article 23(3). 


a If the provider cannot execute the removal order on grounds of force majeure or de facto 
impossibility not attributable to it, including for objectively justifiable technical or 
operational reasons, it shall, without undue delay, inform the authority issuing the order 
efestablishment of those grounds, using the template set out in Annex V. 


The time period set out in paragraph 24 shall start to run as soon as the reasons referred to 
in the first subparagraph have ceased to exist. 


6. If the provider cannot execute the removal order because it contains manifest errors or does 
not contain sufficient information for its execution, it shall, without undue delay, request 
the necessary clarification te from the authority issuing the order efestablishment, using 
the template set out in Annex V. 


The time period set out in paragraph 24+ shall start to run as soon as the provider has 
received the necessary clarification. 


le The provider shall, without undue delay and using the template set out in Annex VI, 
inform the issuing authority, Coordinating Authority of establishment and the EU Centre 
of the measures taken to execute the removal order, indicating, in particular, whether the 
provider removed the child sexual abuse material or disabled access thereto in all Member 
States and the date and time thereof. 


8. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 
in order to amend Annexes IV, V and VI where necessary to improve the templates in view 
of relevant technological developments or practical experiences gained. 
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Article 14a 
Procedure for cross-border removal orders 


1. Subject to Article 14, where the hosting service provider does not have its main 
establishment or legal representative in the Member State of the authority that issued 
the removal order, that authority shall, simultaneously, transmit a copy of the 
removal order to the Coordinating Authority of the Member State where the hosting 
service provider has its main establishment or where its legal representative resides 
or is established. If the receiving Coordinating Authority is not the competent 
authority, it shall transmit the order to the competent authority for the purpose of the 
procedure of this Article. 


Z, Where a hosting service provider receives a removal order as referred to in this 
Article, it shall take the measures provided for in Article 14 and take the necessary 
measures to be able to reinstate the content or access thereto, in accordance with 
paragraph 6 of this Article. 


3. The Coordinating Authority or the competent authority of the Member State where 
the hosting service provider has its main establishment or where its legal 
representative resides or is established may, on its own initiative, within 72 hours of 
receiving the copy of the removal order in accordance with paragraph 1, scrutinise 
the removal order to determine whether it seriously or manifestly infringes this 
Regulation or the fundamental rights and freedoms guaranteed by the Charter. 


Where it finds an infringement, it shall, within the same period, adopt a reasoned 
decision to that effect. 


4. The Coordinating Authority or the competent authority shall, before adopting a 
decision pursuant to the second subparagraph of paragraph 3, inform the competent 
authority that issued the removal order of its intention to adopt the decision and of its 
reasons for doing so. 


=F Where the Coordinating Authority or the competent authority adopts a reasoned 
decision in accordance with paragraph 3 of this Article, it shall, without delay, 
transmit that decision to the authority that issued the removal order, the hosting 
service provider and the EU Centre. 


Where the decision finds an infringement pursuant to paragraph 3 of this Article, the 
removal order shall cease to have legal effects. 


6. Upon receiving a decision finding an infringement communicated in accordance with 
paragraph 5, the hosting service provider concerned shall without undue delay 
reinstate the content or access thereto, without prejudice to the possibility to enforce 
its terms and conditions in accordance with Union and national law. 
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Article 15 
Redress and provision of information 


1. Providers of hosting services that have received a removal order issued in accordance with 
Article 14, as well as the users who provided the material, shall have the right to an 
effective redress. That right shall include the right to challenge such a removal order before 


the courts of the Member State of the competent—udicial autherityorindependent 
administrative authority that issued the removal order. 


la. If the order is repealed as a result of a redress procedure, the provider shall without 
undue delay reinstate the material or access thereto, without prejudice to the 
possibility to enforce its terms and conditions in accordance with Union and national 
law), 


2. When the removal order becomes final, the 
administrative authority that issued the removal order shall, without undue delay, transmit 
a copy thereof and copies of the information it has received pursuant to Article 14 (5) 
to (7) to the Coordinating Authority of establishment. The Coordinating Authority of 
establishment shall then, without undue delay, transmit a-cepy¥ copies thereof to all other 
Coordinating Authorities and the EU Centre through the system established in 
accordance with Article 39(2). 


For the purpose of the first subparagraph, a removal order shall become final upon the 
expiry of the time period for appeal where no appeal has been lodged in accordance with 
national law or upon confirmation of the removal order following an appeal. 


3. Where a provider removes or disables access to child sexual abuse material pursuant to a 
removal order issued in accordance with Article 14, it shall without undue delay, inform 
the user who provided the material of the following: 


(a) the fact that it removed the material or disabled access thereto; 


(b) the reasons for the removal or disabling, providing a copy of the removal order upon 
the user’s request; 


(c) the user’s right to judicial redress referred to in paragraph | and the user’s right to 
submit complaints to the Coordinating Authority in accordance with Article 34. 


3a. The provider shall establish and operate an accessible, age-appropriate and _user- 
friendly mechanism that allows users to submit to it complaints about alleged 
infringements of its obligations under this Section. It shall process such complaints in 
an objective, effective and timely manner. 


s Wording copied from Art. 4(7) of the TCO Regulation. 
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4. vast issuing authority er Sao ee mane may decide sedueS!, wee 


cial ores aad afiet havin bansuliea if ereuary with relevant pubiic aikcnie 


that the provider is not to disclose any information regarding the removal of or disabling of 
access to the child sexual abuse material, where and to the extent necessary to avoid 
interfering with activities for the prevention, detection, investigation and prosecution of 
child sexual abuse or related criminal offences. 


In such a case: 


(a) the #idicial autheritorindependent_administrative—authority issuing the removal 
order shall inform the provider of its decision specifying the applicable time 
period that shall be setthe+time-peried not longer than necessary and not exceeding 
twelve si-weeks, during which the provider is not to disclose such information; 


(b) the obligations set out in paragraph 3 shall not apply during that time period; 


eee pices specifying the adplicable i Myario® 


The issuing Fhatidicial-authortyorindependentadministrative authority may decide to 


extend the time period referred to in the second subparagraph, point (a), by a further time 
period of maximum six weeks, where and to the extent the non-disclosure continues to be 


necessary. In that case, the issuing thatjudicial -authorityorindependent-admunistrative 


authority shall inform the provider of its decision, specifying the applicable time period. 


aN cue wi. 


Section 5 
Blocking obligations 


Article 16 


Blocking orders 


1. The competent authority Coerdinatine Authority of establishment shall have the power te 
Fegtest the-eotnpercit dicta attherte—of the Venber State tht destonated of at 


independent_administrative authority of that Member Stateto issue a blocking order, in 


accordance with relevant national requirements, requiring a provider of internet access 
services under the jurisdiction of that Member State to take reasonable measures to prevent 


users cue ae known eld sexual abuse nie sake by-all uniform resource 


ene with stele 440), sine 0b) caeeeiey the EU Cenc 4s 


si PCY comment: see footnote 15 below. 
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la. The provider shall execute the blocking order as soon as possible and in any event 
within one week of receipt thereof. The provider shall take the necessary measures to 
ensure that it is capable of reinstating access in accordance with Article 18(1a). 


Blocking oo “earty Ht all as nee assessments necessary to doses 
ashether the eonditiers-of paraaraph tba been |e 
Fethatend,it shal, where-appropriate: 


oF Artes nih point 


se Hides Esncial and wclnslociecl pis. 
(e} ates a EU—Centre—to Prog = HOSES SES toa Rens 


blodking ane shall be issied: aie aoe the following conditions are met: 
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(a) other equally effective and less intrusive measures than blocking cannot be 
taken to prevent access to child sexual abuse material or it is likely that such 
measure will fail; oer is-e¥ sence ef the-serv ee wees — be ee the pest 


sie et ade es eee oe 


(b) the blocking order is necessary to prevent the dissemination of the-child sexual abuse 
material te-users in the Union, having regard in-particulartethe-quantity_and natare 


efthe- material to the need to protect the rights of the victims aad the-existence and 
implementation bythe provider ofa poley_to-addressthe tisk of such dissemination; 


(d) the reasons for issuing the blocking order outweigh negative consequences for the 
rights and legitimate interests of all parties affected, having regard in particular to the 
need to ensure a fair balance between the fundamental rights of those parties, 
including the exercise of the users’ freedom of expression and information and the 
provider’s freedom to conduct a business. 


When assessing whether the conditions of the first subparagraph have been met, account 
Ly ve ae obs all euued facts ang circumstances sy eS case at ib Dend. — Bey 


one CRON shes ene ein Deron he cee 


A blocking order; shall: 


(a) where—necessary, specify effective—and—prepertionate limits and—safeguards 
necessary to ensure that a blocking order is targeted and that any negative 
consequences referred to in paragraph 4, point (d), remain limited to what is strictly 
necessary; 


(b) subject to paragraph 6, ensure that the period of application remains limited to what 
is strictly necessary. 


6. The issuing Coerdinatine—authority shall specify in the blocking order the period during 
which it applies, indicating the start date and the end date. 


The period of application of blocking orders shall not exceed five years. 
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ce In-respect_of the_blockine—orders_that the-competent judicial _autheritorindependent 
administrative-authority issued atts request+The Coordinating Authority or the issuing 
authority shall, where necessary and at least once every year, assess whether any 
substantial changes to the grounds for issuing the blocking orders have occurred and 
particular, whether the conditions of paragraph 4 continue to be met. 


pe ee 


revocation of such -order, Where necessary in the light of the outcome of that assessment 
or te—take—account—of justified +equests—or other relevant information, including 
information obtained through the reports referred to in Article +8 17(5a) and6), 
respectively an order shall be modified or repealed by the issuing authority, where 


relevant at the request of the Coordinating Authority. Fhe-provisions-ofthis Section 
shall apph-te-such requests, mutatismutandis. 


Article 17 


Additional rules regarding blocking orders 


i Fhe-Coordinatine Authority of establishment shall issue the A blocking orders-+referred+o 
in-Articlet6 shall be issued using the template set out in Annex VII. Blocking orders shall 


include: 


(b) identification details of the eempetent—udicialautherity—or—the—independent 
administrative authority issuing the blocking order and authentication of the blocking 


order by that authority; 


(c) the name of the provider and, where applicable, its legal representative; 


(d) clear information enabling the provider to identify and locate the child sexual 
abuse material:the-specifie service in respect of which the detection orderis issued; 


(e) the start date and the end date of the blocking order; 


g PCY comment: the proposal means that a blocking order can only be issued if the subject- 
matter of the blocking is on the list provided for by the EU Centre. This list is compiled 
according to Article 36(1)(b) that stipulates additional requirements, including that the 
blocked online location must be displayed from a third country. Do Member States think 
that there should be such a requirement? Or should it be sufficient that Member States 
share their blocking orders with the EU Centre and other Member States once they 
become final? 
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4a. 


(ea) where—applicable, the effeetive-and—prepertionate limits referred to_in_and 
necessary-safeguards pursuantte Article 16(5); 


(f) a sufficiently detailed statement of reasons explaining why the blocking order is 
issued; 


(fa) reporting requirements pursuant to paragraph 5a; 


(g) areference to this Regulation as the legal basis for the blocking order; 


(h) the date, time stamp and electronic signature of the judicial autherity—or—the 
independent administrative-authority issuing the blocking order; 


(i) easily understandable information about the redress available to the addressee of the 
blocking order, including information about redress to a court and about the time 
periods applicable to such redress. 


The cempetent pidicial_authority_or_independent_administrative authority issuing the 
blocking order shall address it to the main establishment of the provider or, where 
applicable, to its legal representative designated in accordance with Article 24. 


The blocking order shall be transmitted to the provider’s point of contact referred to in 
Article 23(1) by electronic means capable of producing a written record under 
conditions that allow to establish the authentication of the sender, including the 
accuracy of the date and the time of sending and receipt of the order, to the 
Coordinating Authority of establishment and to the EU Centre, through the system 
established in accordance with Article 39(2). 


The blocking order shall be drafted-transmitted in any of the official languages declared 
by the provider pursuant to Article 23(3). 


The order may also be transmitted in any of the official languages of the Member 
State issuing the order, provided that it is accompanied by a translation of at least the 
most important elements necessary for the execution of the order into any of the 
official languages declared by the provider in accordance with article 23(3). 


If the provider cannot execute the blocking order on grounds of force majeure or de 
facto impossibility not attributable to it, including for objectively justifiable technical 
or operational reasons, it shall, without undue delay, inform the authority issuing the 
order of those grounds, using the template set out in Annex yy. 


If the provider cannot execute the blocking order because it contains manifest errors or 
does not contain sufficient information for its execution, the provider shall, without undue 
delay, request the necessary clarification te from the authority issuing the order 


Coordinatine Authority of establishment using the template set out in Annex VIII. 
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5a. 


The provider shall, without undue delay and using the template set out in Annex xx, 
inform the issuing authority of the measures taken to execute the blocking order, 
indicating, in particular, whether the provider has prevented access to child sexual 
abuse material. 


The authority issuing the order may require the provider to report to it at regular 
intervals on the measures taken and their functioning to execute a blocking order, 
including the effective and proportionate limitations and safeguards provided for. 


Upon request of the issuing authority, the provider shall also provide, without undue 
delay, such reports or any other information relating to the execution of the blocking 
order needed for the purpose of the assessment referred to in Article 16(7). 


The Commission shall be empowered to adopt delegated acts in accordance with Article 86 
in order to amend Annexes VII, yy, aad-VIII and xx where necessary to improve the 
templates in view of relevant technological developments or practical experiences gained. 


Article 18 


Redress and provision of information nfermation-and-repertine_of blecking_orders 


la. 


Providers of internet access services that have received a blocking order;as-wel-as and 
users who provided er-were-prevented from accessine-a-_specticitenm-of blocked material 
indicated by the uniform resource locators in-execution of such orders, shall have a right to 
effective redress. That right shall include the right to challenge the blocking order before 
the courts of the Member State of the competent—judicial authority—orindependent 
administrative authority that issued the blocking order. 


If the order is repealed as a result of a redress procedure, the provider shall without 
undue delay reinstate access to the material, without prejudice to the possibility to 
enforce its terms and conditions in accordance with Union and national law. 


When the blocking order becomes final, the competent judicial autherityor independent 
administrative authority that issued the blocking order shall, without undue delay, transmit 
a copy thereof and copies of information it has received pursuant to Article 17 (4a) to 
(5a) the Coordinating Authority of establishment. The Coordinating Authority of 
establishment shall then, without undue delay, transmit a-cepy copies thereof to all other 
Coordinating Authorities and the EU Centre through the system established in 
accordance with Article 39(2). 


For the purpose of the first subparagraph, a blocking order shall become final upon the 
expiry of the time period for appeal where no appeal has been lodged in accordance with 
national law or upon confirmation of the removal order following an appeal. 
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a: The provider shall establish and operate an accessible, age-appropriate and user-friendly 
mechanism that allows users to submit to it-withit-a+easonabletimeframe, complaints 
about alleged infringements of its obligations under this Section. It shall process such 
complaints in an objective, effective and timely manner.!¢ 


4. Where a provider prevents users from accessing child sexual abuse material the-aniferm 
resource tecaters pursuant to a blocking order issued in-accordance-with Article, it shall 
take reasonable measures to inform-the those users of the following: 


(a) the fact that it does so pursuant to a blocking order; 


Hs}— the reasons ter doi so ren tcie_upon tediest ees ot the bloekine order 


(c) the users? right of users who provided the blocked material to judicial redress 
referred to in paragraph 1, thei rights of users to submit complaints to the provider 
through the mechanism referred to in paragraph 3 and to the Coordinating Authority 
in accordance with Article 34,as-welLas_thei +richt to-submitthe requests referred to 
ip-parasraphs. 

5. FRe—proastder aad te teers eferred te pate Le be ented te_fedtitest the 


prevented _from_accessing—a specific item of material indicated by 
oo ee eae ade sian 


ieee ee ee Were 
eonsiders the +eatest te be Hettted Ht shall reaqtest editeatoen_orte: seater of the 


eis 2m Lictting brie aandine the nena Godan forat ee GREE; mnie 


a Er ae 


te PCY comment: this complaint mechanism applies only to blocking orders. Do Member 


States think that a horizontal mechanism of providers along the lines of Article 20 DSA 
would be preferable (in combination with the complaint mechanism of Coordinating 
Authorities in Article 34)? 
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Section 5a 
Delisting obligations 


Article 18a 
Delisting orders 


The competent authority shall have the power to issue an order, in accordance with 
relevant national requirements, requiring a provider of online search engines under 
the jurisdiction of that Member State to take reasonable measures to delist an online 
location where child sexual abuse material can be found from appearing in search 
results. 


The provider shall execute the delisting order without undue delay and in any event 
within one week of receipt of the order. The provider shall take the necessary 
measures to ensure that it is capable of reinstating the delisted online location to 
appear in search results in accordance with Article 18c(2). 


A delisting order shall be issued where the following conditions are met: 


(a) the delisting is necessary to prevent the dissemination of the child sexual abuse 
material in the Union, having regard in particular to the need to protect the 
rights of the victims; 


(b) search results correspond, in a sufficiently reliable manner, to online locations 
where child sexual abuse material can be found. 


The issuing authority shall specify in the delisting order the period during which it 
applies, indicating the start date and the end date. 


The period of application of delisting orders shall not exceed five years. 


The Coordinating Authority or the issuing authority shall, where necessary and at 
least once every year, assess whether any substantial changes to the grounds for 
issuing the delisting orders have occurred and whether the conditions of paragraph 4 
continue to be met. 


Where necessary in the light of the outcome of that assessment or information of the 
reports referred to in Article 18b(6) an order may be modified or repealed by the 
issuing authority, where relevant at the request of the Coordinating Authority. 
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Article 18b 
Additional rules regarding delisting orders 


A delisting order shall be issued using the template set out in annex zz. Delisting 
orders shall include: 


(a) identification details of the authority issuing the delisting order and 
authentication of the order by that authority; 


(b) the name of the provider and, where applicable, its legal representative; 


(c) clear information enabling the provider to identify and locate the child sexual 
abuse material; 


(d) the start and end date of the delisting; 


(e) a sufficiently detailed statement of reasons explaining why the delisting order is 
issued; 


(f) reporting requirements pursuant to point 6; 
(g) areference to this Regulation as the legal basis for delisting; 


(h) the date, time stamp and electronic signature of the authority issuing the 
delisting order; 


(i) easily understandable information about the redress available, including 
information about redress to a court and about the time periods applicable to 
such redress. 


The authority issuing the delisting order shall address it to the main establishment of 
the provider or, where applicable, to its legal representative designated in accordance 
with Article 24. 


The delisting order shall be transmitted to the provider’s point of contact referred to 
in Article 23(1) by electronic means capable of producing a written record under 
conditions that allow to establish the authentication of the sender, including the 
accuracy of the date and the time of sending and receipt of the order to the 
Coordinating Authority of establishment and to the EU Centre, through the system 
established in accordance with Article 39(2). 
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3. The delisting order shall be transmitted in any of the offical languages declared by 
the provider pursuant to Article 23(3). 


The order may also be transmitted in any of the official languages of the Member 
State issuing the order, provided that it is accompanied by a translation of at least the 
most important elements necessary for the execution of the order into any of the 
offical languages declared by the provider in accordance with Article 23(3). 


4. If the provider cannot execute the delisting order on grounds of force majeure or de 
facto impossibility not attributable to it, including for objectively justifiable technical 
or operational reasons, it shall, without undue delay, inform the authority issuing the 
order of those grounds, using the template set out in Annex qq. 


=a If the provider cannot execute the delisting order because it contains manifest errors 
or does not contain sufficient information for its execution, the provider shall, without 
undue delay, request the necessary clarification from the authority issuing the order, 
using the template set out in Annex pp. 


6. The provider shall, without undue delay and using the template set out in Annex ww, 
inform the issuing authority of the measures taken to execute the delisting order, 
indicating, in particular, whether the provider has prevented search results for the 
online location with child sexual abuse material to appear. 


The authority issuing the order may require the provider to report to it regularly on 
the measures taken to execute a delisting order. 


da The Commission shall be empowered to adopt delegated acts in accordance with 
Article 86 in order to amend Annexes zz, qq and pp where necessary to improve the 
templates in view of relevant technological developments or practical experiences 


gained. 
Article 18c 
Redress and provision of information 
1. Providers of online search engines that have received a delisting order and users that 


provided the material to a delisted online location shall have a right to effective 
redress. That right shall include the right to challenge the delisting order before the 
courts of the Member State of the authority that issued the delisting order. 


Zs If the order is repealed as a result of a redress procedure, the provider shall without 
undue delay reinstate the delisted online location to appear in search results, without 
prejudice to the possibility to enforce its terms and conditions in accordance with 
Union and national law. 
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3. When the delisting order becomes final, the issuing authority shall, without undue 
delay, transmit a copy thereof and information it has received pursuant to Article 18b 
(4) to (6) to the Coordinating Authority of establishment. The Coordinating Authority 
of establishment shall then, without undue delay, transmit a copies thereof to all other 
Coordinating Authorities and the EU Centre through the system established in 
accordance with Article 39(2). 


For the purpose of the first subparagraph, a delisting order shall become final upon 
the expiry of the time period for appeal where no appeal has been lodged in 
accordance with national law or upon confirmation of the delisting order following an 
appeal. 


3a. The provider shall establish and operate an accessible, age-appropriate and _ user- 
friendly mechanism that allows users to submit to it complaints about alleged 
infringements of its obligations under this Section. It shall process such complaints in 
an objective, effective and timely manner. 


4. Where a provider prevents users from obtaining search results for child sexual abuse 
material corresponding to an online location pursuant to a delisting order, it shall 
take reasonable measures to inform users that provided the material to a delisted 
online location and those users of the following: 


(a) the fact that it does so pursuant to a delisting order; 


(b) the right of users that provided the material to a delisted online location to 
judicial redress referred to in paragraph 1 and users’ right to submit 
complaints to the Coordinating Authority in accordance with Article 34. 


Section 6 
Additional provisions 


Article 19 
Liability of providers 


Providers of relevant information society services shall not be liable for child sexual abuse offences 
if seleh—beeause they carry out, in good faith, the-necessary activities to comply with the 
requirements—of this Regulation, in particular activities aimed at assessing and mitigating risk, 
detecting, identifying, reporting, removing, disabling efaccess to, blocking or delisting from 
search results reporting online child sexual abuse #+-accerdance-with these requirements. 
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Article 20 
Victims’ right to information 


Persons residing in the Union shall have the right to receive, upon their request, from the 
Coordinating Authority designatedby in the Member State where they reside, information 
regarding any instances where the dissemination of known child sexual abuse material 
depicting them is reported to the EU Centre pursuant to Article 12. Persons with 
disabilities shall have the right to ask and receive such an information in a manner 
accessible to them. 


That Coordinating Authority shall transmit the request to the EU Centre through the 
system established in accordance with Article 39(2) and shall communicate the results 
received from the EU Centre to the person making the request. 


The request referred to in paragraph | shall indicate: 
(a) the relevant item or items of known child sexual abuse material; 


(b) where applicable, the individual or entity that is to receive the information on behalf 
of the person making the request; 


(c) sufficient elements to demonstrate the identity of the person making the request. 
The information referred to in paragraph | shall include: 

(a) the identification of the provider that submitted the report; 

(b) the date of the report; 


(c) whether the EU Centre forwarded the report in accordance with Article 48(3) and, if 
so, to which authorities; 


(d) whether the provider reported having removed or disabled access to the material, in 
accordance with Article 13(1), point (1). 


Article 21 
Victims’ right of assistance and support for removal 


Providers of hosting services shall provide reasenable—assistance, on request, to persons 
residing in the Union that seek to have one or more specific items of known child sexual 
abuse material depicting them removed or to have access thereto disabled by the provider. 
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Ze Persons residing in the Union shall have the right to receive support;-+penthei request, 
from the Coordinating Authority designated-by in the Member State where they-persen 
resides, to request assistance,suppert from the EU Centre when they seek to have a 
provider of hosting services remove or disable access to one or more specific items of 
known child sexual abuse material depicting them. Persons with disabilities shall have the 
right to ask and receive any information relating to such support in a manner accessible to 
them. 


That Coordinating Authority shall transmit the request to the EU Centre through the 
system established in accordance with Article 39(2) and shall communicate the results 
received from the EU Centre to the person making the request. 


3: The requests referred to in paragraphs | and 2 shall indicate the relevant item or items of 
child sexual abuse material. Fherequest-dees not have te indicatea-specifie provider. 
4. The EU Centre’s support referred to in paragraph 2 shall include, as applicable: 


(b) verifying whether the provider removed or disabled access to that item or those 
items, including by conducting the searches referred to in Article 49(1); 


(c) notifying the item or items of known child sexual abuse material depicting the person 
to the provider and requesting removal or disabling of access, in accordance with 
Article 49(2); 


(d) where necessary, informing the Coordinating Authority of establishment of the 
presence of that item or those items on the service, with a view to the issuance of a 
removal order pursuant to Article 14. 


Article 22!” 
Preservation of information 


1. Providers of hosting services and providers of interpersonal communications services shall 
preserve the content data and other data processed #1-connectiontethe-measurestaken to 
comply with this Regulation and the personal data generated through such processing, 
when the following measures have been taken or for the PURO of complaints or redress 
procedures cemptaints-on ; ; SH , as applicable: 


rm PCY comment: to be revised pending further discussions on detection orders. 
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la. 


(a) executing a detection order issued pursuant to Article 7, or a removal order issued 
pursuant to Article 14 [or a blocking order pursuant to Article 16 or a delisting 
order pursuant to Article 18a ]; 


(b) reporting information that indicate potential online child sexual abuse to the EU 
Centre pursuant to Article 12; 


(c) blocking the account of, or suspending or terminating the provision of the service to, 
the user concerned; 


(d) handling users’ complaints to the provider or to the Coordinating Authority, or the 
exercise of users’ right to administrative or judicial redress, in respect of alleged 
infringements of this Regulation:. 


(e}— 


Upon a request responding—to—requests issued by a competent taw—enfercement 
authorityies and judicial _autherities—[in accordance with the applicable law], providers 
shall with-a-iew-+te provideing them requesting authority with the necessary information 
for the prevention, detection, investigation or prosecution of child sexual abuse offences; 
or the handling of complaints or admininstrative or judicial redress proceedings, 
insofar as the content data and other data have been preserved for one of the purposes in 
paragraphs 1(a) to (d). relate to-a-report that the-provider has-_submitted tothe EU Centre 
purstantte Article 42, 


As regards the first subparagraph, point (a), the provider may also preserve the information 
for the purpose of improving the effectiveness and accuracy of the technologies to detect 
online child sexual abuse for the execution of a detection order issued to it in accordance 
with Article 7. However, it shall not store any personal data for that purpose. 


Providers shall preserve the information referred to in paragraph 1 for no longer than 
necessary for the applicable purpose and, in any event, no longer than 12 months from the 
date of the measures taken that led to the obligation to preserve the content data and 
other data processed-reportine-_orofthe removal or disabling of access, whicheveroceurs 
first. 


Providers Fhey—shall, upon request from the competent natienalauthority —or—court, 
preserve the information for a further specified period, set by thatthe requesting authority 
er-court-where and to the extent necessary for ongoing administrative or judicial redress 
proceedings, as referred to in paragraph 1, point (d). 
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Providers shall ensure that the information referred to in paragraph 1 is preserved in a 
secure manner and that the preservation is subject to appropriate technical and 
organisational safeguards. Those safeguards shall ensure, in particular, that the information 
can be accessed and processed only for the purpose for which it is preserved, that a high 
level of security is achieved and that the information is deleted upon the expiry of the 
applicable time periods for preservation. Providers shall regularly review those safeguards 
and adjust them where necessary. 


Article 23 
Points of contact 


Providers of relevant information society services shall establish a single point of contact 
allowing for direct communication, by electronic.means, with the Coordinating 
Authorities, other competent authorities of the Member States, the Commission and the EU 
Centre, for the application of this Regulation. 


The providers shall communicate to the EU Centre and make public the information 
necessary to easily identify and communicate with their single points of contact, including 
their names, addresses, the electronic mail addresses and telephone numbers. 


The providers shall specify in the information referred to in paragraph 2 the official 
language or languages of the Union, which can be used to communicate with their points 
of contact. 


The specified languages shall include at least one of the official languages of the Member 


State in which the provider has its main establishment or, where applicable, where its legal 
representative resides or is established. 


Article 24 
Legal representative 


Providers of relevant information society services which do not have their main 
establishment in the Union shall designate, in writing, a natural or legal person as its legal 
representative in the Union for the purposes of this Regulation. 


The legal representative shall reside or be established in one of the Member States where 
the provider offers its services. 
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The provider shall mandate its legal representatives to be addressed in addition to or 
instead of the provider by the Coordinating Authorities, other competent authorities of the 
Member States and the Commission on all issues necessary for the receipt of, compliance 
with and enforcement of orders and decisions issued in relation to this Regulation, 
including detection orders, removal orders-and, blocking orders and delisting orders. 


The provider shall provide its legal representative with the necessary powers and resources 
to cooperate with the Coordinating Authorities, other competent authorities of the Member 
States and the Commission and to comply with the orders and decisions referred to in 
paragraph 3. 


The designated legal representative may be held liable for non-compliance with obligations 
of the provider under this Regulation, without prejudice to the liability and legal actions 
that could be initiated against the provider. 


The provider shall notify the name, address, the electronic mail address and telephone 
number of its legal representative designated pursuant to paragraph | to the Coordinating 
Authority in the Member State where that legal representative resides or is established, and 
to the EU Centre. The provider or the legal representative Fhey—shall ensure that that 
information is up to date and publicly available. 


The designation of a legal representative within the Union pursuant to paragraph | shall 
not amount to an establishment in the Union. 
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CHAPTER III 


SUPERVISION, ENFORCEMENT AND COOPERATION 


Section 1 
Coordinating Authorities of the Member States-forchild sexual abuse issues 


Article 25 


Coordinating Authorities forehild-sexvalabuseissues and other competent authorities 


1. Member States shall, by (Pate— #ve-eighteen months from the date of entry into force of 
this Regulation}, designate one or more competent authorities as responsible for the 
application and enforcement of this Regulation (‘competent authorities’) 


Ze Member States shall, by the date referred to in paragraph 1, designate one of the competent 
authorities as their Coordinating Authority for child sexual abuse issues (‘Coordinating 
Authority’). 


The Coordinating Authority shall be responsible for all matters related to the application 
and enforcement of this Regulation in the Member State concerned, unless that Member 
State has assigned certain specific tasks or sectors to other competent authorities. 


The Coordinating Authority shall in any event be responsible for ensuring coordination at 
national level in respect of those matters and for contributing to the effective efferent and 
consistent application and enforcement of this Regulation throughout the Union. 


3. Where a Member State designates more than one competent authority in addition to the 
Coordinating Authority, it shall ensure that the respective tasks of those authorities and of 
the Coordinating Authority are clearly defined and that they cooperate closely and 
Secu lege gen ing their tasks. F ee pees State spaces ia communicate 


Canes and aft Commission. 


4. Within one week after the designation of the Coordinating Authorities and any—other 
competent authorities pursuant—te—paragraph—t, Member States shall make publicly 
available, and communicate to the Commission and the EU Centre, the names of their 
Coordinating Authority and other compentent authorities as well as their respective 
tasks or sectors. They shall keep that information updated. 
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Each—-Member States shall easurethat-a—contact_peintisdesignated_or established a 
contact point within its the—Coordinating Authority’s office to handle requests for 
clarification, feedback and other communications in relation to all matters related to the 
application and enforcement of this Regulation+athat Member-State. Member States shall 
make the information on the contact point publicly available and communicate it to the EU 
Centre. They shall keep that information updated. 


Within two weeks after the designation of the Coordinating Authorities pursuant to 
paragraph 2, the EU Centre shall set up an online register listing the Coordinating 
Authorities and their contact points. The EU Centre shall regularly publish any 
modification thereto. 


Coordinating Authorities may, where necessary for the performance of their tasks under 
this Regulation, request the assistance of the EU Centre in carrying out those tasks, in 
particular, by requesting the EU Centre to: 


(a) provide certain information or technical expertise on matters covered by this 
Regulation; 


(b) assist in assessing, in accordance with Article 5(2), the risk assessment conducted or 
updated or the mitigation measures taken by a provider of hosting or interpersonal 
communication services under the jurisdiction of the Member State that designated 
the requesting Coordinating Authority; 


(c) provide opinion on verify the possible need to request competent national 
authorities to issue a detection order,-aremevaterder,orableckineorderin respect 


of a service under the jurisdiction of the Member State that designated that 
Coordinating Authority; 


[(d) provide opinion on verify the effectiveness of a detection order er-a+remevalerder 
issued upon the request of the requesting Coordinating Authority. ]!8 


The EU Centre shall provide such assistance free of charge and in accordance with its tasks 
and obligations under this Regulation-and insefar-as its resources-_and priorities allow. 1° 


18 
19 
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PCY comment: to be revised pending further discussions on detection orders. 
PCY comment: will be moved to an article on the EU Centre. 
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Article 26 
Requirements for Coordinating Authorities 


Member States shall ensure that the Coordinating Authorities that they have designated 
carry out perferm their tasks under this Regulation in an objective;+mpartial transparent 
anctimely and non-discriminatory manner, while fully respecting the fundamental rights 

2° Member States shall ensure that their Coordinating Authorities 
have adequate technical, financial and human resources to carry out their tasks. 


The Coordinating Authorities shall not seek or take instructions from any other body 
in relation to carrying out their tasks under this Regulation. 


Regulation, the Coordinating Authorities eal aet ee complet fe wee Fe one 


> > > 


(a) are legally and functionally independent from any other public authority; 


abuse,-other than_their tasks under this Regulation. 


Paragraph 2-1 shall not prevent supervision of the Coordinating Authorities in accordance 
with national constitutional law,te+the-extent that such-supervision_dees-not affect ther: 


salsa nod ate th ee 


The Coordinating Authorities and other competent authorities shall ensure that their 
relevant _members—of staff have the required qualifications, experience, integrity and 
technical skills to perform their duties. 


2 Wording copied from Art. 13(2) of the TCO Regulation. Further discussions are needed as 
regards functional and organisational independence. 
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a: The management and other staff of the Coordinating Authorities shall, in accordance with 
Union or national law, be subject to a duty of professional secrecy both during and after 
their term of office, with regard to any confidential information which has come to their 
knowledge in the course of the performance of their tasks. Member States shall ensure that 
the management and other staff are subject to rules guaranteeing that they can carry out 
their tasks in an objective, impartial and independent manner, in particular as regards their 
appointment, dismissal, remuneration and career prospects. 


Section 2 
Powers of Coerdinatine-the Authorities of Member States 


Article 277! 
Investigatory and enforcement powers 


1. Where needed in order to fer—carrying out their tasks under this Regulation, 
Coordinating Authorities or other competent authorities shall have the following powers 
of investigation, in respect of conduct by providers of relevant information society 
services falling within the competence underthe jurisdiction of the their Member State 


that desienated them: 


(a) the power to require those providers, as well as any other persons acting for purposes 
related to their trade, business, craft or profession that may reasonably be aware of 
information relating to a suspected infringement of this Regulation, to provide such 


information without undue delay-within-a+easonable time-period; 


44 PCY comment: copied word for word from Art. 51 of the DSA as a baseline for further 


discussions. Differences include that (i) both the Coordinating and competent authorities are 
included; (ii) this text speaks about “user’’, not “the recipient of a service” and (iii) in point 
3b below the wording “or the infringement results in the regular and structural facilitation 
of child sexual abuse offences” has been maintained. The restruturing of Articles 27 to 30 to 
ensure alignement with DSA has lead to the fact that some cross-references need to be 
corrected. This will be done once the text is stable. The PCY would like to hear the 
delegations’ views about the need to list MS’ investigatory and enforcement powers in 
light of the fact that most of these powers already belong to law enforcement 
authorities. 
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(b) 


(c) 


(d) 


the power to carry out, or to request a judicial authority to order, on-site 
inspections of any premises that those providers or the-otherthose persons referred 
te4n-point{a) use for purposes related to their trade, business, craft or profession, or 
to request other public authorities to do so, in order to examine, seize, take or obtain 
copies of information relating to a suspected infringement ef thisRegulatien in any 
form, irrespective of the storage medium; 


the power to ask any member of staff or representative of those providers or the ether 
those persons to give explanations in respect of any information relating to a 


suspected infringement ofthis—Regulation—and to record the answers by any 
technical means; 


the power to request information, including to assess whether the measures taken to 
execute a detection order, removal order,—er blocking order or delisting order 
comply with the requirements of this Regulation. 


2.4— Where needed for carrying out their tasks under this Regulation, Coordinating 
Authorities or other competent authorities shall have the following enforcement powers, 
in respect of providers of relevant information society services falling within the 


competence under the jurisdiction of the their Member State that designated them: 


(a) 


(b) 


(c) 


(d) 


(c) 


the power to accept the commitments offered by those providers in relation to their 
compliance with this Regulation and to make those commitments binding; 


the power to order the cessation of infringements ef+this-Regulatien and, where 
appropriate, to impose remedies proportionate to the infringement and necessary to 
bring the infringement effectively to an end or to request a judicial authority in 
their Member States to do so; 


the power to impose fines, or request a judicial authority in their Member State to do 
so, in accordance with Article 35 for failure to comply with infringements—of this 
Regulation, including nen-comphanee—with any of the investigative orders issued 


pursuant to paragraph 1 of this Article 27+and+e-point(b) ofthis-paragraph; 


the power to impose a periodic penalty payment, or to request a judicial authority 
to do so, in accordance with Article 35 to ensure that an infringement ef this 
Regulation is terminated in compliance with an order issued pursuant to point (b) of 
this subparagraph or for failure to comply with any of the orders issued pursuant to 


paragraph 1 of this Article. 27+and+te-peint{(b) efthis-paragraph; 


the power to adopt interim measures or to request the competent national judicial 
authority to do so, to avoid the risk of serious harm. 
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2. Manber States ies ead tone entoreentert poste te the Coarditine AtHthoHties| 


3 As regards the first subparagraph 4, points (c) and (d), Coordinating Authorities or other 
competent autorities shall also have the enforcement powers set out in those points-alse 
in respect of the other persons referred to in paragraph 1Article 27, for failure to comply 
with any of the orders issued to them pursuant to that paragraph Article. 4. They shall 
only exercise those enforcement powers after having provided those other persons in good 
time with all relevant information relating to such orders, including the applicable time 
period, the fines or periodic payments that may be imposed for failure to comply and 
redress-_the possibilities for redress. 


Artiele29 
(dditional.enfk 


3.+—Where needed for carrying out their tasks under this Regulation, Coordinating 
Authorities or other competent authorities shall havethe-additional enforcement powers 


referred +en-_parasraph 2, in respect of providers of relevant information society services 
falling within the competence underthe jurisdiction of their Member State, where that 


destonited tent provided that 


(a}—all other powers pursuant to this Articles27and2$8-to bring about the cessation of an 
infringement of this Regulation have been exhausted; 


(b)—and the infringement has not been remedied or is continuing and is -persistss 


(e)}—_ the infringement causes-causing serious harm which cannot be avoided through the 
exercise of other powers available under Union or national law, also have the power 
to take the following measures: 


(a) to require the management body of the providers, without undue delay, to examine 


the situation, within-a-+reasenable time-period andte-: 


4}— adopt and submit an action plan setting out the necessary measures to terminate 
the infringement; 


44)—ensure that the provider takes those measures; and 


4#4—report on the measures taken; 
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(b) where the Coordinating Authority or other competent authorities consider that 
a provider of relevant information society services has not sufficiently complied 
with the requirements of point (a), that the infringement has not been remedied 
or is continuing and is causing serious harm, and that that infringement entails 
a criminal offence involving a threat to the life or safety of persons or the 
infringement results in the regular and structural facilitation of child sexual 
abuse offences, to request that the competent judicial authority or other 
independent administrative authority of its the Member State that-desienated the 
Coordinating Autheritytoe order the temporary restriction of access of users of the 
service concerned by the infringement or, only where that is not technically feasible, 
to the online interface of the provider on which the infringement takes place. where 


he Coordinati hori ans Gra. 
G) — the provider has not sufficiently complied with the requirements of point (a): 
Ge | . fej . j M4 harm: 


abs otteneces. 


3.—The Coordinating Authority or other competent authorities shall, prior to submitting the 
request referred to in this paragraph 2, point (b), invite interested parties to submit written 
observations within a period that shall not be less than two weeks, describing the 
measures that it intends to request and identifying the intended addressee or 
addressees thereof. The provider, the intended addressee or addressees and any other 
third party demonstrating a legitimate interest shall be entitled to participate in the 
proceedings before the competent judicial authority or other independent 
administrative authority. 


en 


The invitation to-submitwrtter-observations shall- 


lescibfl aerere 
45} td ar Ste tended iddtressece ciddresseces tered 


ee 


4—————Any measure ordered upenthe-request referred _to—in_paragraph2,_peint(b), shall be 


proportionate to the nature, gravity, recurrence and duration of the infringement, without 
unduly restricting access to lawful information by users of the service concerned. 
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The temporary-restriction of access shall be apph-for a period of four weeks, subject to the 
possibility for the competent judicial authority or other independent administrative 
authority of the Member State, in its order, to allow the Coordinating Authority or other 
competent authority to extend that period for further periods of the same lengths, subject 
to a maximum number of extensions set by a that judicial authority or other independent 
administrative authority. 


The Coordinating Authority or other competent authority referred to in the previous 
subparagraph shall only extend the period where-t-censiders, having regard to the rights 
and legitimate-interests of all parties affected by the that restriction and all relevant facts 
and circumstances, including any information that the provider, the addressee or 
addressees and any other third party that demonstrated a legitimate interest may provide to 
it, it considers that both of the following conditions have been met: 


(a) the provider has failed to take the necessary measures to terminate the infringement; 


(b) the temporary restriction does not unduly restrict access to lawful information by 
users of the service, having regard to the number of users affected and whether any 
adequate and readily accessible alternatives exist. 


Where the Coordinating Authority or other competent authority considers that the 
conditions set out in the fourth subparagraph, points (a) and (b) these-tweo-conditions 
have been met but it cannot further extend the period pursuant to the fourth secend 
subparagraph, it shall submit a new request to the competent judicial authority or other 
independent administrative authority, as referred to in the first subparagraph, point 


(b). 
Article 30 
Cone RO ee eH LOH PO HES 


4. 14—The measures taken by the Coordinating Authorities or other competent authorities in 


the exercise of their #vestigatery-and-enfercementpowers listed in paragraphs 1, 2 and 
3 referred ton Articles 27, 28 and 29 shall be effective, dissuasive and proportionate, 


having regard, in particular, to the nature, gravity, recurrence and duration of the 
infringement ef this Regulatier-or suspected infringement to which those measures relate, 
as well as the economic, technical and operational capacity of the provider of relevant 
information society services concerned; where relevant-appHeable. 


7595/23 
ANNEX 


FL/ml 40 
JALI LIMITE EN 


5.2.——Member States shall lay down specific rules and procedures for the exercise of the 
powers pursuant to paragraphs 1, 2 and 3 and shall ensure that any exercise of those 
the uvestigateryand-enfercement powers referred ton Articles 27, 28 and27is subject to 
adequate safeguards laid down in the applicable national law in compliance with the 
Charter and with the general principles of Union law te-respectthe fundamentaliehts 
efal-parties-affected. In particular, those measures shall only be taken in accordance with 
the right to respect for private life and the rights of defence, including the rights to be heard 
and of access to the file, and subject to the right to an effective judicial remedy of all 
parties affected parties. 


Article 31 
Searches to verify compliance 


Coordinating Authorities or other competent authorities shall have the power to carry out 
searches on publicly accessible material on hosting services to detect the dissemination of known or 
new child sexual abuse material, using the indicators contained in the databases referred to in 
Article 44(1), points (a) and (b), where necessary to verify whether the providers of hosting services 
under the jurisdiction of the Member State that designated the Coordinating Authorities comply 
with their obligations under this Regulation. 


Artiele 32 
Notificeti C] hild ae ‘al 
s Shall nave the. +-to ders of Services sender the 


mms spile Hus of sy i esl abuse ital ed ngs hg a ses abl 


The-re st-shall eles -set-out the identification details of the-€ 


on: its contact referred-to-in Article 2 the hece information 


Sn ee Bho 20 st-shall alse—cle ae eT NRT ENT OE ider’s 


ae PCY comment: It is the view of the PCY that this power can be explained and described in a 


recital that builds on recital 40 of the TCO Regulation and Article 16 DSA. 
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Section 3 
Other provisions on enforcement 
Article 33 
Jurisdiction 


The Member State in which the main establishment of the provider of relevant information 
society services is located shall have jurisdiction for the purposes of this Regulation. 


A provider of relevant information society services which does not have an establishment 
in the Union shall be deemed to be under the jurisdiction of the Member State where its 
legal representative resides or is established. 


Where a provider failed to appoint a legal representative in accordance with Article 24, all 
Member States shall have jurisdiction. Where a Member State decides to exercise 
jurisdiction under this subparagraph, it shall inform all other Member States and ensure 
that the principle of ne bis in idem is respected. 


Article 3473 


Right efutsers-of the-service to lodge a complaint 


Users and any body, organisation or association mandated to exercise the rights 
conferred by this Regulation on their behalf shall have the right to lodge a complaint 
against providers of relevant information society services alleging an infringement of 
this Regulation affectingthem agaiist-providers_of relevant information seciety_services 
with the Coordinating Authority designated—-by in the Member State where the user is 
located resides-or is-established. 


Coordinating Authorities shall provide child-friendly mechanisms to submit a complaint 
under this Article and adopt a child-sensitive approach when handling complaints 
submitted by children, taking due account of the child's age, maturity, views, needs and 
concerns. 


2 PCY comment: copied word for word from Art. 53 of the DSA. 
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24 


The Coordinating Authority receiving the-complaint shall assess the complaint and, where 
appropriate, transmit it to the Coordinating Authority of establishment, accompanied, 


where appropriate, by an opinion. 


Where the complaint falls under the responsibility of another competent authority in its 
Member State, that-designated the Coordinating Authority receiving the complaint,that 


Coordinating Autherityshall transmit it to that ether-cempetent authority. 


During these proceedings, both parties shall have the right to be heard and receive 
appropriate information about the status of the complaint, in accordance with 
national law. 


Article 34b*+ 
Representation 


Without prejudice to Directive (EU) 2020/1828 or to any other type of representation 
under national law, users of relevant information society services shall at least have 
the right to mandate a body, organisation or association to exercise the rights 
conferred by this Regulation on their behalf, provided the body, organisation or 
association meets all of the following conditions: 


(a) it operates on a non-profit basis; 
(b) it has been properly constituted in accordance with the law of a Member State; 


(c) its statutory objectives include a legitimate interest in ensuring that this 
Regulation is complied with. 


Providers of relevant information society services shall take the necessary technical 
and organisational measures to ensure that complaints submitted by bodies, 
organisations or associations referred to in paragraph 1 of this Article on behalf of 
recipients of the service through the mechanisms referred to in Article xx are 
processed and decided upon with priority and without undue delay. 


PCY comment: copied word for word from Art. 86 of the DSA. To be discussed in relation 
to Articles 18(3) and 34. 
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34. 


45. 


Article 3575 
Penalties 


Member States shall lay down the rules on penalties applicable to infringements of the 
obligations pursuant to Chapters II and V of this Regulation by providers of relevant 
information society services within their competence underthei-jurisdiction and shall 
take all the necessary measures to ensure that they are implemented in accordance with 
Article 27. 


Fhe-pPenalties shall be effective, proportionate and dissuasive. Member States shall, by 
[Date of application of this Regulation], notify the Commission of those rules and of those 
measures and shall notify it, without delay, of any subsequent amendments affecting them. 


Member States shall ensure that the maximum amount of fines that may be penalties 
imposed for an a failure to comply with an obligation laid down in Chapters II and V 
infrmeementof this Regulation shall be not exceed 6 % of the annual worldwide income 
eretebal turnover of the providers concerned in the preceding financial business-year-ef 
the-previder. 3-Member States shall ensure that the maximum amount of the fine that 
may be imposed Penalties for the supply of incorrect, incomplete or misleading 
information, failure to reply or rectify incorrect, incomplete or misleading information oF 
and failure to submit to an en-si#te inspection shall be not exceed 1% of the annual income 


or worldwide gtebalturnover of the preceding business—year of the provider or the-other 


person concerned in the preceeding financial year-+referredt+o+nArticle27. 


Member States shall ensure that the maximum amount of a periodic penalty payment shall 
be not exceed 5 % of the average daily worldwide glebalturnover or income of the 
provider erthe-ether-persen_referred tein Article 27 in the preceding financial year per 
day, calculated from the date specified in the decision concerned. 


Member States shall ensure that the competent authorities, when deciding whether to 
impose a penalty and when determining the type and level of penalty, account is taken of 
all relevant circumstances, including: 

(a) the nature, gravity and duration of the infringement; 


(b) whether the infringement was intentional or negligent; 


(c) af previous infringements by the provider or the other person; 


a PCY comment: copied word for word from Art. 52 of the DSA (except paragraph 4 that is 
taken from the TCO Regulation). 
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(d) the financial strength of the provider-orthe-other person; 
(e) the level of cooperation of the provider with the competent authorities erthe-other 
person; 
(f) the nature and size of the provider-er+the-other-persen, in particular whether it is a 
micro, small or medium-sized enterprise; 
(g) the degree of fault of the provider or other person, taking into account the technical 
and organisational measures taken by the provider it-to comply with this Regulation. 
Section 4 
Cooperation 
Article 36 78 
Identification and submission of online child sexual abuse 
1. Coordinating Authorities shall submit to the EU Centre, without without undue delay and 


through the system established in accordance with Article 39(2): 


(a) 


(b) 


specific items of material and transcripts. of conversations that Coordinating 
Authorities or that the competent judicial authorities or other independent 
administrative authorities of a Member State have identified, after a diligent 
assessment, as constituting child sexual abuse material or the solicitation of children, 
as applicable, for the EU Centre to generate indicators in accordance with Article 
44(3); 


exact uniform resource locators indicating the electronic location of the 
information spectfic—items—of—material that Coordinating Authorities or that 
competent judicial authorities or other independent administrative authorities of a 
Member State have identified, after a diligent assessment, as constituting child sexual 
abuse material, hosted by providers of hosting services not offering services in the 
Union, that cannot be removed due to those providers’ refusal to remove or disable 
access thereto and to the lack of cooperation by the competent authorities of the third 
country having jurisdiction, for the EU Centre to compile the list of uniform resource 
locators in accordance with Article 44(3). 


26 ~~ PCY comment: the LEWP should leave this Article for now and return to it once more clarity 
is reached on the detection and blocking orders. 
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Member States shall take the necessary measures to ensure that the Coordinating 
Authorities that they designated receive, without undue delay, the material identified as 
child sexual abuse material, the transcripts of conversations identified as the solicitation of 
children, and the uniform resource locators, identified by a competent judicial-authority or 
other independent administrative authority than the Coordinating Authority, for submission 
to the EU Centre in accordance with the first subparagraph. 


2: Upon the request of the EU Centre where necessary to ensure that the data contained in the 
databases referred to in Article 44(1) are complete, accurate and up-to-date, Coordinating 
Authorities shall verify or provide clarifications or additional information as to whether the 
conditions of paragraph 1, points (a) and (b) have been and, where relevant, continue to be 
met, in respect of a given submission to the EU Centre in accordance with that paragraph. 


ae Member States shall ensure that, where their law enforcement authorities receive a report 
of the dissemination of new child sexual abuse material or of the solicitation of children 
forwarded to them by the EU Centre in accordance with Article 48(3), a diligent 
assessment is conducted in accordance with paragraph 1 and, if the material or 
conversation is identified as constituting child sexual abuse material or as the solicitation 
of children, the Coordinating Authority submits the material to the EU Centre, in 
accordance with that paragraph, within one month from the date of reception of the report 
or, where the assessment is particularly complex, two months from that date. 


4. They shall also ensure that, where the diligent assessment indicates that the material does 
not constitute child sexual abuse material or the solicitation of children, the Coordinating 
Authority is informed of that outcome and subsequently informs the EU Centre thereof, 
within the time periods specified in the first subparagraph. 


Article 37°” 
Cross-border cooperation among Coordinating Authorities 


1. Where a Coordinating Authority that is not the Coordinating Authority of establishment 
has reasons to suspect that a provider of relevant information society services infringed this 
Regulation in a manner negatively affecting the users of the service in the Member 
State of that Coordinating Authority, it may shal-request the Coordinating Authority of 
establishment to assess the matter and to take the necessary investigatory and enforcement 
measures to ensure compliance with this Regulation. 


dthis Regulation +n—a-manner 


ivehine—atteast three Member 


soe serces HHH 


Haat aid tke the ees HES HOE and She teenie castes fee 
1 ieate RSaaadiae 


a PCY comment: copied word for word from Art. 58 of the DSA. 
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2 Fhe A request errecommendation pursuant referred to in paragraph | shall be duly 
reasoned and at least indicate: 


(a) the point of contact of the provider as set out in Article 23; 


(b) a description of the relevant facts, the provisions of this Regulation concerned and 
the reasons why the Coordinating Authority that sent the requesterthe-Commissien 
suspects, that the provider infringed this Regulation including the description of the 
negative effects of the alleged infringement; 


(c) any other information that the Coordinating Authority that sent the request—or+the 
Commission, considers relevant, including, where appropriate, information gathered 
on its own initiative and or suggestions for specific investigatory or enforcement 
measures to be taken, including interim measures. 


ex The Coordinating Authority of establishment shall take utmost account of the requests 

pursuant to paragraph 1 of this Article assess the a gah cleans taking into 

: men p sraph—t+. Where it 

considers ne it has Tieuinigent penn 46 asses_the Me occt Lpencemodd erte-act 

upon the request er-recemmendation and has reasons to consider that the Coordinating 

Authority that sent the request-erthe-Commissioen, could provide additional information, it 

may request such information. The time period laid down in paragraph 4 shall be 
suspended until that additional information is provided. 


4. The Coordinating Authority of establishment shall, without undue delay and in any event 
not later than two months following receipt of the request er-recommendation pursuant 
referred_to in—paragraph 1, communicate to the Coordinating Authority that sent the 
fequcsinoe tne Coneuice: the exuteome-ofits assessment of the suspected infringement; 
erthat-of anyother-_competent_authority_pursuant_te_national law —wheretelevant, and; 
where-appHeable, an explanation of the investigatory or enforcement measures taken or 
envisaged in relation thereto to ensure compliance with this Regulation. 
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Article 3878 
Joint investigations 


1. Coordinating Authorities may participate in joint investigations, which may be coordinated 
with the support of the EU Centre, of matters covered by this Regulation, concerning 
providers of relevant information society services that offer their services in several 
Member States. 


Such joint investigations are without prejudice to the tasks and powers of the participating 
Coordinating Authorities and the requirements applicable to the performance of those tasks 
and exercise of those powers provided for in this Regulation. 


De The participating Coordinating Authorities shall make the results of the joint investigations 
available to other Coordinating Authorities, the Commission and the EU Centre, through 
the system established in accordance with Article 39(2), for the fulfilment of their 
respective tasks under this Regulation. 


Article 38a’? 


Mutual assistance 


1. The Coordinating Authorities, the competent authorities of the Member States and the 
EU Centre Digital Services-Coordinators—and the-Connisston-shall cooperate closely 

and provide each other with mutual assistance in order to apply this Regulation in a 
consistent and _ efficient manner. Mutual assistance shall include, in particular, 
exchange of information in accordance with this Article and the duty of the Digital 


Coordinating huthority to inform all 
Coordinating Authorities ” 2 B F 


the-Conmmeission about the opening of an savestiiatibn and the intention to take a final 


decision, including its assessment, in respect of a specific provider of a relevant 
information society + fary service. 


aS PCY comment: The PCY observes that a number of delegations have requested 


clarifications about what is meant with joint investigations, a concept that is close also to 
law enforcement and judicial cooperation. The PCY notes that the elements of the Article 
can be found in Article 58 of the DSA. Do delegations believe that there is need for this 
Article in this context? Are there elements of Article 57 of the DSA on mutual 
assistance, for instance on exchange of information, that can be more relevant? Do 
delegations wish to include an additional article along the lines of Art. 57 of the DSA 
on mutual assistance? 
? Copied from Article 57 of the DSA (changes vis-a-vis the DSA in italics). 
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For the purpose of an investigation, a Coordinating Authority the 


Coordinator-of-establishment may request a coordinating Authority in another Member 
State_other—Digital_Services—Coordinators_ to provide specific information in their 
possession as regards a specific provider of relevant information society intermediary 


services or to exercise their investigative powers referred to in Article 27 with 


regard to specific information located i in their Member State. Where appropriate, the 


Coordinating Authorit receiving the request may involve 


other competent authorities or other public authorities of the Member State in 
question. 


The Coordinating Authori fot fi f receiving the request 


pursuant to paragraph 2 Shall comply with such request and inform the requesting 
Coordinating Authorit f E about the action 
taken, without undue delay and no later than two months after its receipt, unless: 


(a) the scope or the subject matter of the request is not sufficiently specified, 
justified or proportionate in view of the investigative purposes; or 


b) neither the requested Coordinating Authori fot f f nor 


other competent authority or other public authority of that Member State is in 
possession of the requested information nor can have access to it; or 


c the request cannot be complied with without infringing Union or national law. 


The Dist f f Coordinating Authority receiving the request shall 


justify its refusal by submitting a reasoned reply, within the period set out in the first 
subparagraph. 


la. 


Article 39 
GeneraleCooperation, coordination and information-sharing system 


Coordinating Authorities shall cooperate with each other, other competent authorities of 
the Member States that - designated the Coordinating Authority, the Commission, the EU 
Centre and other relevant Union agencies, including Europol, to facilitate the performance 
of their respective tasks under this Regulation and to ensure its effective, efficient and 
consistent application and enforcement. 


The authorities and agencies referred to in paragraph 1 may, including with the 
support from the EU Centre, coordinate their work under this Regulation with a view 
to avoiding interference with criminal investigations in different Member States and 
to avoiding duplication of efforts. 
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The EU Centre shall establish and maintain one or more reliable and secure information 
sharing systems supporting communications between Coordinating Authorities, the 
Commission, the EU Centre, other relevant Union agencies and providers of relevant 
information society services. 


The Coordinating Authorities, the Commission, the EU Centre, other relevant Union 
agencies and providers of relevant information society services shall use the information- 
sharing systems referred to in paragraph 2 for all relevant communications pursuant to this 
Regulation. 


The Commission shall adopt implementing acts laying down the practical and operational 
arrangements for the functioning of the information-sharing systems referred to in 
paragraph 2 and their interoperability with other relevant systems. Those implementing 
acts shall be adopted in accordance with the advisory procedure referred to in Article 87. 


[No compromise texts on Articles 40 to 82] 
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CHAPTER V 


DATA COLLECTION AND TRANSPARENCY REPORTING 
Article 83 


Data collection 


1. Providers of relevant information society services that were subject to orders under 
Articles 7, 14, 14a, 16 and 18a 


communications_services,_providers—of internet _access_services shall collect data on the 
following topics and make that information available to the EU Centre upon request: 


(a) where the provider has been subject to a detection order issued in accordance with 
Article 7: 


~ the measures taken to comply with the order, including the technologies used 
for that purpose and the safeguards provided; 


— the error rates of the technologies deployed to detect online child sexual abuse 
and measures taken to prevent or remedy any errors; 


— in relation to complaints and cases submitted by users in connection to the 
measures taken to comply with the order, the number of complaints submitted 
directly to the provider, the number of cases brought before a judicial authority, 
the basis for those complaints and cases, the decisions taken in respect of those 
complaints and in those cases, the average time needed for taking those 
decisions and the number of instances where those decisions were subsequently 
reversed; 


(b) the number of removal orders and_cross-border removal orders issued to the 


provider in accordance with Articles 14 and 14a—the—average—time—needed_for 
removing or disabling access to the item or items of child sexual abuse material in 
question: 


(c) the total number of items of child sexual abuse material that the provider removed or 
to which it disabled access, broken down by whether the items were removed or 
access thereto was disabled pursuant to a removal order, _cross-border_removal 
order or to a notice submitted by a Competent Authority, the EU Centre or a third 
party or at the provider’s own initiative; 


(d) the number of blocking orders issued to the provider in accordance with Article 16; 


da) the number of delisting orders issued to the provider in accordance with Article 
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(e) the number of instances in which the provider invoked Article 8(3), Article 14(5) or 


(6), ef Article 17(4a) or (5) or Article 18b(4) or (5), together with the reasons 
grounds therefor; 


The Coordinating Authorities [or other competent authorities] shall collect data on the 
following topics and make that information available to the EU Centre upon request: 


outcome of that action-and the reasdiie for Gime it: 
= where-no-action-was taken, the reasons for not taking any action: 


(b) the most important and recurrent risks of online child sexual abuse, as reported by 
providers of hosting services and providers of interpersonal communications services 
in accordance with Article 53 or identified through other information available te+he 


=pordiial ne 


(c) a list of the providers of hosting services and providers of interpersonal 
communications services to which the Coordinating Authority addressed a detection 
order in accordance with Article 7; 
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PCY comment: The PCY concludes that many delegations have objections to this provision, 
at least as regards the level of detail. The PCY also observes that it would be a major 
undertaking to ensure that a report is flagged as it is processed or being an element of a 
process in a way that ensures a feedback loop whenever a measure is taken in connection 
with the processing. The PCY would like to hear if delegations see prospects for a 
simplified reporting requirement concerning the follow-up of reports or if such 
reporting should be part of future developments. Would it help if MS would be given 
extra time for the implementation of these developments? 
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(d) the number of detection orders issued in accordance with Article 7, broken down by 
provider and by type of online child sexual abuse, and the number of instances in 
which the provider invoked Article 8(3); 


(e) a list of providers of hosting services to which the-Ceordinatine Authority issued a 


removal order or cross-border removal order were issued in accordance with 
Articles 14 and 14a; 


(f) the number of removal orders issued in accordance with Article 14, broken down by 
provider, the-timeneeded_te_remove—or—disable_access_tothe_item_or_items—of 
child -sexual abuse-material concerned, and the number of instances in which the 
provider invoked Article 14(5) and (6); 


(g) the number of blocking orders issued in accordance with Article 16, broken down by 
provider, and the number of instances in which the provider invoked Article 17(4a) 
or (5); 


h) a list of relevant information society services. to which the Coordinatin 


Authority addressed a decision taken pursuant to Articles 27, 28 or 29, the type 
of decision taken, and the reasons for taking it;] 


(i) the instances in which the opinion of the EU Centre pursuant to Article 7(4)(d) 
substantially deviated from the opinion of the Coordinating Authority, specifying the 
points at which it deviated and the main reasons for the deviation;: 


(ia) the number of complaints received in accordance with Article 34 broken down 
by what the alleged infringement of this Regulation was concerned with and 
who submitted the complaint. 


3: The EU Centre shall collect data and generate statistics on the detection, reporting, 
removal of or disabling of access to online child sexual abuse under this Regulation. The 
data shall be in particular on the following topics:*! 

(a) the number of indicators in the databases of indicators referred to in Article 44 and 
the development of that number as compared to previous years; 

(b) the number of submissions of child sexual abuse material and solicitation of children 
referred to in Article 36(1), broken down by Member State that designated the 
submitting Coordinating Authorities, and, in the case of child sexual abuse material, 
the number of indicators generated on the basis thereof and the number of uniform 
resource locators included in the list of uniform resource locators in accordance with 
Article 44(3); 

a PCY comment: It seems to the PCY that several items in paragraph 3 can only be properly 
assessed and discussed once increased clarity on the outcome of their respective basis is 
reached. 
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(c) the total number of reports submitted to the EU Centre in accordance with Article 12, 
broken down by provider of hosting services and provider of interpersonal 
communications services that submitted the report and by Member State the 
competent authority of which the EU Centre forwarded the reports to in accordance 
with Article 48(3); 


(d) the online child sexual abuse to which the reports relate, including the number of 
items of potential known and new child sexual abuse material and instances of 
potential solicitation of children, the Member State the competent authority of which 
the EU Centre forwarded the reports to in accordance with Article 48(3), and type of 
relevant information society service that the reporting provider offers; 


(e) the number of reports that the EU Centre considered manifestly unfounded, as 
referred to in Article 48(2); 


(f) the number of reports relating to potential new child sexual abuse material and 
solicitation of children that were assessed as not constituting child sexual abuse 
material of which the EU Centre was informed pursuant to Article 36(3), broken 
down by Member State; 


(g) the results of the searches in accordance with Article 49(1), including the number of 
images, videos and URLs by Member State where the material is hosted; 


(h) where the same item of potential child sexual abuse material was reported more than 
once to the EU Centre in accordance with Article 12 or detected more than once 
through the searches in accordance with Article 49(1), the number of times that that 
item was reported or detected in that manner. 


(1) the number of notices and number of providers of hosting services notified by the EU 
Centre pursuant to Article 49(2); 


(j) number of victims of online child sexual abuse assisted by the EU Centre pursuant to 
Article 21(2), and the number of these victims that requested to receive such 
assistance in a manner accessible to them due to disabilities. 


Providers of relevant information society services that were subject to orders under 
Articles 7, 14, 14a 16 and 18a The idlers of i Services Hiders of 


5 es, the 
Cine RTE: = ther senpeleit aithoritieg and ihe EU Centre shall 
ensure that the data referred to in paragraphs 1, 2 and 3, respectively, is stored no longer 
than is necessary for the transparency reporting referred to in Article 84. The data stered 


referred to in paragraphs 1 to 3 shall not contain any personal data. 


= ‘aya ens 9 las ave Ox4 Qe ern mae 
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Article 84 


Transparency reporting 


1. Each provider of relevant information society services that were subject to orders under 
Articles 7, 14, 14a, 16 and 18a during the relevant year shall draw up an annual report 
on its activities under this Regulation. That report shall compile the information referred to 
in Article 83(1). The providers shall, by 31 January of every year subsequent to the year to 
which the report relates, make the report available to the public and communicate it to the 
Coordinating Authority of establishment, the Commission and the EU Centre. 


2 Each Coordinating Authority shall draw up an annual report on its activities under this 
Regulation. That report shall compile the information referred to in Article 83(2). It shall, 
by 31 March of every year subsequent to the year to which the report relates, make the 
report available to the public and communicate it to the Commission and the EU Centre. 


3. Where a Member State has designated several competent authorities pursuant to Article 25, 
it shall ensure that the Coordinating Authority draws up a single report covering the 
activities of all competent authorities under this Regulation and that the Coordinating 
Authority receives all relevant information and support needed to that effect from the other 
competent authorities concerned. 


4. The EU Centre 17-2-47-close-e ration-with the-C nati ities. shall draw 


up an annual report on its activities under this Regulation. That report shall alse compile 
and analyse the information contained in the reports referred to in paragraphs 2 and Article 
83(3). The EU Centre shall, by 30 June of every year subsequent to the year to which the 
report relates, make the report available to the public and communicate it to the 
Commission. 


5. The annual transparency reports referred to in paragraphs 1, 2 and 3 shall not include any 
information that may prejudice ongoing activities for the assistance to victims or the 
prevention, detection, investigation or prosecution of child sexual abuse offences. They 
shall alse-not contain any personal data. 


6. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 
in order to supplement this Regulation with the necessary templates and detailed rules 
concerning the form, precise content and other details of the reports and the reporting 
process pursuant to paragraphs 1, 2 and 3. 
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CHAPTER VI 


FINAL PROVISIONS 
Article 85 
Evaluation 


1. By [five years after the entry into force of this Regulation], and every five years thereafter, 
the Commission shall evaluate this Regulation and submit a report on its application to the 
European Parliament and the Council. 


2; By [five years after the entry into force of this Regulation], and every five years thereafter, 
the Commission shall ensure that an evaluation in accordance with Commission guidelines 
of the EU Centre’s performance in relation to its objectives, mandate, tasks and 
governance and location is carried out. The evaluation shall, in particular, address the 
possible need to modify the tasks of the EU Centre, and the financial implications of any 
such modification. 


3; On the occasion of every second evaluation referred to in paragraph 2, the results achieved 
by the EU Centre shall be assessed by the Commission, having regard to its objectives and 
tasks, including an assessment of whether the continuation of the EU Centre is still 
justified with regard to those objectives and tasks. 


4. The Commission shall report to the European Parliament and the Council the findings of 
the evaluation referred to in paragraph 3. The findings of the evaluation shall be made 
public. 

yi For the purpose of carrying out the evaluations referred to in paragraphs 1, 2 and 3, the 


Coordinating Authorities and Member States and the EU Centre shall provide information 
to the Commission at its request. 


6. In carrying out the evaluations referred to in paragraphs 1, 2 and 3, the Commission shall 
take into account the relevant evidence at its disposal. 


cf Where appropriate, the reports referred to in paragraphs 1 and 4 shall be accompanied by 
legislative proposals. 
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Article 86 
Exercise of the delegation 


The power to adopt delegated acts is conferred on the Commission subject to the 
conditions laid down in this Article. 


The power to adopt delegated acts referred to in Articles 3, 8, 13, 14, 17, 47 and 84 shall be 
conferred on the Commission for an indeterminate period of time from [date of adoption of 
the Regulation] **. 


The delegation of power referred to in Articles 3, 8, 13, 14, 17, 47 and 84 may be revoked 
at any time by the European Parliament or by the Council. A decision to revoke shall put 
an end to the delegation of the power specified in that decision. It shall take effect the day 
after the publication of the decision in the Official Journal of the European Union or at a 
later date specified therein. It shall not affect the validity of any delegated acts already in 
force. 


Before adopting a delegated act, the Commission shall consult experts designated by each 
Member State in accordance with the principles laid down in the Inter-institutional 
Agreement of 13 April 2016 on Better Law-Making. 


As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the 
European Parliament and to the Council. 


A delegated act adopted pursuant to Articles 3, 8, 13, 14, 17, 47 and 84 shall enter into 
force only if no objection has been expressed either by the European Parliament or the 
Council within a period of two months of notification of that act to the European 
Parliament and the Council or if, before the expiry of that period, the European Parliament 
and the Council have both informed the Commission that they will not object. That period 
shall be extended by two months at the initiative of the European Parliament or of the 
Council. 


PCY comment: The PCY has taken note of the comment from some delegations that the 
delegation in relation to Article 47 is concerned with subject-matters that may not be 
appropriate for such delegation due to its principal nature. The PCY suggests that this 
particular issue is discussed in connection with Article 47 and, where needed, in connection 
with the other Articles referred to here. 
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Article 87 
Committee procedure 


1. For the purposes of the adoption of the implementing acts referred to in Article 39(4), the 
Commission shall be assisted by a committee. That committee shall be a committee within 
the meaning of Regulation (EU) No 182/2011. 


2: Where reference is made to this paragraph, Article 4 of Regulation (EU) No 182/2011 shall 
apply. 
Article 883 
Repeal 


Regulation (EU) 2021/1232 is repealed from [date of application of this Regulation]. 
Article 89 


Entry into force and application 


This Regulation shall enter into force on the twentieth day following that of its publication in the 
Official Journal of the European Union. 


It shall apply from 6 months after its entry into force*. 


This Regulation shall be binding in its entirety and directly applicable in all Member States. 


Done at Brussels, 


For the European Parliament For the Council 
The President The President 
= PCY comment: Many delegations are in favour of exploring how the Temporary Regulation 


could be prolonged and/or how to allow voluntary detection on a permanent basis by 
including the provisions of the Temporary Regulation in this Regulation. The PCY 
concludes that this Article could be used for such a purpose. 

PCY comment: The 6-month time period should be considered in connection with the time 
period laid down in Article 25(1). It seems to the PCY that a time period of at least twelve 
months is required here. 
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